Russia-Linked Hackers Hit iOS, Android Devices with Sophisticated Exploit Chains
A sophisticated hacking campaign has been uncovered by cybersecurity firm Sekoia, targeting both iOS and Android users in Europe and the US. The attacks are attributed to Midnight Blizzard, a Russian state-sponsored threat actor known for its highly targeted and sophisticated methods of gathering intelligence.
Midnight Blizzard, also referred to as APT29, Cozy Bear, or The Dukes, has been linked to Russia’s Foreign Intelligence Service (SVR) and has previously targeted government organizations, diplomats, IT services providers, and NGOs. This latest campaign involves the use of “watering hole” attacks, where compromised or cloned high-profile websites are used as entry points for malicious code.
The hackers injected JavaScript code into several websites, including those of a Ukrainian gas production company, a major industry trade association, and a far-right European political party. The code was designed to fingerprint visitors, gathering their browser and device configuration data before delivering the exploit. This approach is known as an adversary-in-the-middle (AiTM) setup.
The malicious code was also injected into lookalike domains that acted as reverse proxies for high-profile sites, including the website of a luxury hotel near sensitive UK government institutions. By targeting this specific location, Midnight Blizzard may have sought to compromise diplomatic delegations and high-profile guests through targeted spear-phishing campaigns. The group’s interest in Ukrainian President Volodymyr Zelensky’s recent stay at Raffles London is also suspect.
In addition to the watering hole attacks, Sekoia identified a supply chain attack targeting the Ukrainian web analytics service Plerdy. This exposed hundreds of websites to the exploit kit for one week, including military and special forces sites. The hackers were able to add their malicious code to the tracker file, allowing them to harvest sensitive data from these sites.
The exploit chains used by Midnight Blizzard target previously patched vulnerabilities, demonstrating the group’s ability to adapt and reuse existing exploits. Two of the chains target iOS devices, relying heavily on the DarkSword exploit kit uncovered earlier this year. The first chain reimplements the initial remote code execution (RCE) code from DarkSword for arbitrary read/write access, while the second chain relies solely on DarkSword for initial access and privilege escalation.
The final payload in these chains was designed to fully harvest the device’s data, including messages, emails, voicemails, credentials, tokens, contacts, calls, calendar entries, browser cookies and history, photos, and iCloud Drive content. The third exploit chain targets Android users via two previously patched Chrome vulnerabilities.
The widespread use of packaged n-day exploit chains by state-sponsored threat actors like Midnight Blizzard lowers the cost and technical threshold required to conduct advanced mobile exploitation. As a result, we can expect to see more frequent reuse of commercial surveillance vendor (CSV) exploits among these groups in the long term.
To protect yourself from such attacks, it’s essential to keep your devices up-to-date with the latest security patches. This campaign serves as a reminder that even previously patched vulnerabilities can be exploited by sophisticated attackers. Regularly monitor your website analytics and consider implementing additional security measures, such as web application firewalls or intrusion detection systems, to detect and prevent similar attacks in the future.
Source: SecurityWeek — 2026-11-05